Welcome to ISAserver.org

PIX-ISA 2000

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2000 General] >> General >> PIX-ISA 2000

Page: [1]

Message

<< Older Topic Newer Topic >>

PIX-ISA 2000 - 26.Dec.2007 11:07:28 AM

conleymarley

Posts: 7
Joined: 7.Mar.2005
Status: offline

Hello,
We are running behind a ISA 2000 server with two NICs. Our new parent company has sent us a Cisco PIX 501 VPN Firewall. They want us to be able to connect to their internal web site. They said it is configured except for the external IP. We are no Cisco experts here. Should we put the Cisco behind our ISA or in front? Thanks

Post #: 1

Featured Links*

RE: PIX-ISA 2000 - 30.Dec.2007 8:31:25 PM

AHIT

Posts: 1561
Joined: 22.Jul.2002
From: Sydney, Australia
Status: offline

or put in parallel????
depends on what they've configured the "external" IP address of the PIX to be.
if it is placed "inside" your network "behind" your ISA, then you'll need to create publishing rules on ISA to allow the VPN traffic.
it it placed "outside" your network "in front" of your ISA, then then VPN will not be directly visible to your internal network.
if it is placed "in parallel" with your ISA then the VPN stuff may work immediately but you now also have another path for internet traffic to flow out of (and into) your network that may not have the granular controls you've defined in your ISA.
This article by Tom Shinder is about "playing well with others - ISA fireall and PIX" which may be relevant. http://www.isaserver.org/tutorials/2004isapixdmz.html

_____________________________

http://www.ahit.com.au/isa
(Previous nick: Tolk)

(in reply to conleymarley)

Post #: 2